@oneciel-ai/ciel-runtime 0.2.40 → 0.2.42

package/CHANGELOG.md

@@ -5,6 +5,21 @@ capability, followed by the complete commit ledger merged into each release.
 
 ## Unreleased
 
+## 0.2.42 — 2026-09-08
+
+- Preserve fragmented OSC palette responses and other VT control strings as
+  complete frames in the Windows input bridge. Prevent RGB palette replies
+  from appearing in the Codex draft; retain literal text and bounded buffering.
+
+## 0.2.41 — 2026-09-07
+
+- Automatically authenticate Codex model and Ciel MCP requests to LAN-bound
+  routers using a separate process-local header. Preserve native OpenAI
+  authorization and strip Ciel credentials before forwarding upstream.
+- Reassemble fragmented Windows console VT input sequences before forwarding
+  them to ConPTY, preventing split paste boundaries from entering the Codex
+  draft as text. Preserve literal text and standalone Escape (100ms idle bound).
+
 ## 0.2.40 — 2026-09-07
 
 - Authenticate internal router health checks when the web backend uses a

package/ciel_runtime_support/codex_router_auth.py

@@ -0,0 +1,88 @@
+"""Attach router authentication without replacing native OpenAI credentials."""
+import json
+from pathlib import Path
+import re
+from urllib.parse import urlparse
+
+from .router_access import is_loopback_address
+
+CLIENT_TOKEN_ENV = "CIEL_RUNTIME_ROUTER_CLIENT_TOKEN"
+
+
+def authenticated_codex_command(cmd: list[str], env: dict[str, str], router_base: str) -> list[str]:
+    router = urlparse(router_base)
+    targets = []
+    builtin_base = None
+    overrides = {}
+    index = 1
+    while index < len(cmd):
+        argument = cmd[index]
+        index += 1
+        if argument == '--':
+            break
+        if argument in ('-c', '--config') and index < len(cmd):
+            setting = cmd[index]
+            index += 1
+        elif argument.startswith('--config='):
+            setting = argument.split('=', 1)[1]
+        else:
+            continue
+        key, separator, raw = setting.partition('=')
+        if separator:
+            key = key.strip()
+            # Do not attach credentials based on an overridden earlier URL.
+            overrides = {old: value for old, value in overrides.items()
+                         if not old.startswith(key + '.')}
+            overrides[key] = raw
+    for key, raw in overrides.items():
+        if not raw:
+            continue
+        match = re.fullmatch(r"model_providers\.([\w-]+)\.base_url", key)
+        if match:
+            prefix = f"model_providers.{match.group(1)}"
+        elif key == "openai_base_url":
+            prefix = "model_providers.ciel-runtime-native-auth"
+        elif key == "mcp_servers.ciel-runtime-router.url":
+            prefix = "mcp_servers.ciel-runtime-router"
+        else:
+            continue
+        try:
+            url = urlparse(json.loads(raw))
+        except (ValueError, TypeError):
+            continue
+        # These are Ciel's generated local-router routes, not arbitrary
+        # upstream provider URLs. Only authorize this launch's exact origin.
+        if (not is_loopback_address(url.hostname) and url.scheme == router.scheme
+                and url.netloc == router.netloc
+                and url.path.rstrip('/') in ('/v1', '/backend-api/codex', '/ca/mcp')):
+            targets.append(prefix)
+            if key == 'openai_base_url':
+                builtin_base = raw
+    if not targets:
+        return cmd
+    token = str(env.get("CIEL_RUNTIME_ROUTER_EXTERNAL_TOKEN") or "").strip()
+    if not token:
+        state = env.get("CIEL_RUNTIME_STATE_DIR")
+        if state:
+            try:
+                token = (Path(state) / "router-external-token").read_text(encoding="utf-8").strip()
+            except OSError:
+                pass
+    if not token:
+        return cmd
+    env[CLIENT_TOKEN_ENV] = token
+    options = []
+    if builtin_base is not None:
+        # Modern Codex forbids overriding the built-in `openai` table.
+        # Use a per-launch provider retaining native OpenAI authentication.
+        provider = 'ciel-runtime-native-auth'
+        cmd = [f'model_provider="{provider}"' if item == 'model_provider="openai"' else item for item in cmd]
+        for setting in (f'model_provider="{provider}"',
+                        f'model_providers.{provider}.name="Ciel Runtime Codex"',
+                        f'model_providers.{provider}.base_url={builtin_base}',
+                        f'model_providers.{provider}.wire_api="responses"',
+                        f'model_providers.{provider}.requires_openai_auth=true'):
+            options.extend(['-c', setting])
+    for prefix in dict.fromkeys(targets):
+        options.extend(['-c', f'{prefix}.env_http_headers.x-ciel-runtime-token="{CLIENT_TOKEN_ENV}"'])
+    return [cmd[0], *options, *cmd[1:]]

package/ciel_runtime_support/router_access.py

@@ -201,9 +201,11 @@ class RouterAccessPolicy:
                 and hmac.compare_digest(expected, bridge_expected)
             ):
                 return False
-            return bool(
-                expected and supplied and hmac.compare_digest(expected, supplied)
-            )
+            local_token = str(handler.headers.get("x-ciel-runtime-token") or "").strip()
+            return bool(expected and (
+                (supplied and hmac.compare_digest(expected, supplied))
+                or (local_token and hmac.compare_digest(expected, local_token))
+            ))
         return False
 
 

package/ciel_runtime_support/runtime_constants.py

@@ -97,7 +97,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.40"
+VERSION = "0.2.42"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/runtime_launch.py

@@ -9,6 +9,7 @@ from dataclasses import dataclass
 
 from ciel_runtime_support.claude_environment import CLAUDE_PROJECTED_ENV_KEYS
 from ciel_runtime_support.managed_tool_injection import should_inject_tool, codex_native_web_tool_overrides
+from ciel_runtime_support.codex_router_auth import authenticated_codex_command
 from ciel_runtime_support.runtime_constants import (
     CLAUDE_SERVER_SIDE_WEB_TOOLS,
     CODEX_RUNTIME_API_KEY_ENV,
@@ -973,6 +974,7 @@ def run_codex(
         if workspace_mcp is not None and workspace_mcp_launch is not None:
             workspace_mcp.finish(workspace_mcp_launch)
         raise
+    cmd = authenticated_codex_command(cmd, env, ROUTER_BASE)
     _log_codex_command_for_diagnostics(cmd, env)
     record_launch_state_for_cwd(
         current_launch_cwd_key(),
@@ -1287,6 +1289,7 @@ def run_codex_app_server(
             print(f"Codex App Server listen: {cmd[cmd.index('--listen') + 1]}", flush=True)
         except Exception:
             pass
+    cmd = authenticated_codex_command(cmd, env, ROUTER_BASE)
     _log_codex_app_server_command_for_diagnostics(cmd, env)
     record_launch_state_for_cwd(
         current_launch_cwd_key(),

package/ciel_runtime_support/terminal_input_frames.py

@@ -0,0 +1,89 @@
+"""Reassemble short VT input sequences across parent-console reads."""
+from __future__ import annotations
+
+import threading
+from collections.abc import Callable
+
+
+class TerminalInputFrames:
+    """Do not expose a partial VT sequence to a child's keyboard parser.
+
+    A bounded idle timer preserves a standalone Escape key. Nothing is
+    stripped or rewritten, including literal text resembling paste markers.
+    """
+
+    def __init__(self, write: Callable[[bytes], None], *, idle_seconds: float = 0.1):
+        self.write = write
+        self.idle_seconds = idle_seconds
+        self.pending = bytearray()
+        self.lock = threading.Lock()
+        self.timer: threading.Timer | None = None
+        self.generation = 0
+
+    def feed(self, data: bytes) -> None:
+        with self.lock:
+            self._cancel()
+            ready = bytearray()
+            for byte in data:
+                if not self.pending:
+                    if byte == 0x1b:
+                        self.pending.append(byte)
+                    else:
+                        ready.append(byte)
+                    continue
+                self.pending.append(byte)
+                introducer = self.pending[1]
+                # OSC (including palette replies) and other control strings
+                # end at ST, not at their first printable byte. OSC also
+                # accepts BEL. An ESC ending one read may start ST in the next.
+                if introducer in b']PX^_':
+                    complete = (
+                        self.pending.endswith(b'\x1b\\')
+                        or (introducer == ord(']') and byte == 0x07)
+                        or byte in (0x18, 0x1a)  # CAN/SUB cancel the sequence.
+                        or len(self.pending) >= 4096
+                    )
+                else:
+                    # CSI/SS3 final byte, or a two-byte ESC/Alt key.
+                    complete = (
+                        len(self.pending) == 2 and introducer not in b'[O'
+                    ) or (
+                        len(self.pending) >= 3 and 0x40 <= byte <= 0x7e
+                    ) or len(self.pending) >= 64
+                if complete:
+                    ready.extend(self.pending)
+                    self.pending.clear()
+            if ready:
+                self.write(bytes(ready))
+            if self.pending:
+                generation = self.generation
+                self.timer = threading.Timer(self.idle_seconds, self._expire, args=(generation,))
+                self.timer.daemon = True
+                self.timer.start()
+
+    def _cancel(self) -> None:
+        self.generation += 1
+        if self.timer is not None:
+            self.timer.cancel()
+            self.timer = None
+
+    def _expire(self, generation: int) -> None:
+        with self.lock:
+            if generation != self.generation:
+                return
+            self.timer = None
+            self._flush()
+
+    def _flush(self) -> None:
+        if self.pending:
+            data = bytes(self.pending)
+            self.pending.clear()
+            try:
+                self.write(data)
+            except OSError:
+                pass  # Child may have exited while Escape was pending.
+
+    def close(self) -> None:
+        with self.lock:
+            self._cancel()
+            self._flush()

package/ciel_runtime_support/windows_conpty.py

@@ -13,6 +13,7 @@ from collections.abc import Mapping
 from typing import Any, Callable
 
 from .terminal_platform_io import TERMINAL_INPUT_MODE_RESET
+from .terminal_input_frames import TerminalInputFrames
 from .windows_command_line import command_line_for_create_process
 
 
@@ -980,15 +981,19 @@ class WindowsConPtySession:
             self._parent_input_draft = draft
 
     def _pump_input(self) -> None:
-        while not self._stop.is_set():
-            try:
-                data = self._read_input_bytes()
-                if not data:
+        frames = TerminalInputFrames(self.write)
+        try:
+            while not self._stop.is_set():
+                try:
+                    data = self._read_input_bytes()
+                    if not data:
+                        return
+                    self._observe_parent_input(data)
+                    frames.feed(data)
+                except OSError:
                     return
-                self._observe_parent_input(data)
-                self.write(data)
-            except OSError:
-                return
+        finally:
+            frames.close()
 
 
 __all__ = ["WindowsConPtySession", "conpty_enabled"]

package/docs/journal/2026/09/07/diagnostics/windows/remote-backend-log-access.okf

@@ -0,0 +1,14 @@
+title: Attempt remote web backend log capture for Windows paste-marker issue
+date: 2026-09-07
+target: http://10.0.0.238:9683
+authorization: User requested backend log capture and console/mouse diagnostics.
+request: GET /health without credentials
+response:
+  timestamp: Mon, 07 Sep 2026 18:02:22 GMT
+  status: HTTP/1.0 401 Unauthorized
+  challenge: Bearer realm="ciel-runtime"
+  message: ciel-runtime router external authentication is required.
+conclusion: Backend reachable; administrative authentication required before logs or TUI diagnostics can be retrieved.
+limitation: Remote runtime version, logs, and console state not retrieved; no assertion that paste issue is diagnosed.
+next_requirement: User-provided administrative external access token for this remote backend.
+changes: No remote writes, input injection, configuration changes, or authentication bypass attempted.

package/docs/journal/2026/09/07/diagnostics/windows/remote-console-capture.okf

@@ -0,0 +1,36 @@
+title: Authenticated remote backend console investigation
+date: 2026-09-07
+target: http://10.0.0.238:9683
+credentials: Omitted; user-provided token used only for authenticated requests.
+captures:
+  health:
+    ok: true
+    version: 0.2.40
+    source_fingerprint: 3bc950932f5d1691
+    pid: 21824
+    workspace: c:\users\1347817
+    router_port: 9683
+    instance_id: 9683-a2f58d1342e0
+    active_client_count: 1
+    active_client_pids: [29116]
+    provider: codex
+  chat_health:
+    ok: true
+    base: http://10.0.0.238:9683
+  tui_status:
+    ok: true
+    enabled: true
+    active_count: 0
+    latest_event_id: 0
+    capture_scope: routed runtime traffic
+    excluded: hidden thinking, tool arguments, native traffic that bypasses this router, terminal pixels
+  tui_recent: '{"ok":true,"events":[],"last_id":0,"active":[]}'
+  events_recent: '{"ok":true,"events":[]}'
+source_audit:
+  router_http: Authenticated GET dispatches TUI/events/config/web/chat/runtime APIs; no raw router.log download handler found.
+  tui: Observation API explicitly excludes terminal pixels and native bypass traffic.
+conclusion:
+  confirmed: Remote 0.2.40 is running and reachable on LAN with authentication; one active client recorded.
+  not_confirmed: Clipboard delimiter corruption location, actual ConPTY/fallback selection, mouse state, live terminal input bytes.
+blocker: Existing backend does not expose the raw log and console input/output evidence required for this native-terminal issue.
+remote_changes: None; no input injection, model request, log-level change, or session restart.

package/docs/journal/2026/09/07/release/stable/0.2.41.okf

@@ -0,0 +1,26 @@
+title: Codex LAN client authentication and Windows paste framing
+date: 2026-09-07
+version: 0.2.41
+authorization: User requested handling paste corruption and internal Codex router authentication failure; continuing requested main release workflow.
+causes:
+  auth: Previous patch authenticated health only; native model Authorization cannot double as Ciel administrative token.
+  paste_reproduction: Real Windows Codex 0.153.4 rendered [200~1660377[201~ when ESC and remaining delimiter bytes were written 20ms apart.
+changes:
+  auth: Model and builtin Ciel MCP receive x-ciel-runtime-token from process environment, loaded from this instance token repository; no user TOML edits.
+  scope: Exact router origin only; later URL overrides excluded; native OpenAI Authorization retained.
+  upstream: Existing x-ciel-runtime header exclusion verified; router credential not forwarded to OpenAI.
+  builtin: Reserved openai provider uses a per-launch custom provider retaining requires_openai_auth, verified with actual Codex config loader.
+  paste: Frame CSI/SS3 boundaries across parent reads without stripping or rewriting payload; single Escape flushed after 100ms idle.
+verification:
+  actual_codex_paste: Replayed split input through corrected pump; 1660377 visible, neither delimiter visible; no prompt submitted.
+  actual_codex_http: Local test server received Ciel token on MCP and model requests; native Authorization also present on model requests. Server intentionally returns 400 without inference or forwarding.
+  auth_tests: 5 passed, including real CLI and overridden destination protection.
+  conpty: 33 passed.
+  framing: 3 passed, covering every split, Korean, literal marker text, standalone Escape, arrows and F9.
+  runtime_group: 285 passed with 12 skips before additional URL-override test.
+  router_debug: 25 passed.
+  static: Ruff and architecture budget passed.
+limitations:
+  remote: Original mouse gesture on remote machine not directly replayed; reproduced matching corruption with fragmented native Codex input locally.
+  idle: Incomplete sequences exceeding 100ms idle are flushed unchanged to preserve standalone Escape.
+  deployment: Main workflow and published package verification follow commit.

package/docs/journal/2026/09/08/release/stable/0.2.42.okf

@@ -0,0 +1,18 @@
+title: Windows OSC palette response framing regression
+date: 2026-09-08
+version: 0.2.42
+request: Continue handling user-reported OSC 4 palette strings exposed in console input.
+cause:
+  source: TerminalInputFrames treated ESC ] as a complete two-byte key, forwarding the subsequent OSC body separately.
+  actual_cli_before: Codex rendered 4;0;rgb:0c0c/0c0c/0c0c followed by the test paste.
+change:
+  protocol: Keep OSC, DCS, SOS, PM and APC strings until ST; OSC also accepts BEL; CAN/SUB cancel.
+  safety: Never remove literal text; 4096-byte bound and existing 100ms idle flush retained.
+verification:
+  actual_cli_after: Both palette and paste tests passed; palette text absent and 1660377 still visible. No model prompt submitted.
+  frames: Six tests passed including every control-string split, BEL/ST, plain literal RGB text, bounded malformed strings, standalone Esc and paste.
+  static: Ruff passed.
+reference: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
+limitations: Remote user's terminal not directly manipulated; local real Codex reproduction uses simulated split parent-console reads.
+deployment: Continue main stable release workflow; validate npm artifact after publishing.
+excluded: No Kevin AI Net authentication changes or session restart.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",